kadmin and kadmin.local are command-line interfaces to the Kerberos V5
administration system. They provide nearly identical functionalities;
the difference is that kadmin.local directly accesses the KDC
database, while kadmin performs operations using kadmind.
Except as explicitly noted otherwise, this man page will use “kadmin”
to refer to both versions. kadmin provides for the maintenance of
Kerberos principals, password policies, and service key tables
(keytabs).

The remote kadmin client uses Kerberos to authenticate to kadmind
using the service principal kadmin/ADMINHOST (where ADMINHOST is
the fully-qualified hostname of the admin server) or kadmin/admin.
If the credentials cache contains a ticket for one of these
principals, and the -c credentials_cache option is specified, that
ticket is used to authenticate to kadmind. Otherwise, the -p and
-k options are used to specify the client Kerberos principal name
used to authenticate. Once kadmin has determined the principal name,
it requests a service ticket from the KDC, and uses that service
ticket to authenticate to kadmind.

Since kadmin.local directly accesses the KDC database, it usually must
be run directly on the master KDC with sufficient permissions to read
the KDC database. If the KDC database uses the LDAP database module,
kadmin.local can be run on any host which can access the LDAP server.

Use principal to authenticate. Otherwise, kadmin will append
/admin to the primary principal name of the default ccache,
the value of the USER environment variable, or the username as
obtained with getpwuid, in order of preference.

-k

Use a keytab to decrypt the KDC response instead of prompting for
a password. In this case, the default principal will be
host/hostname. If there is no keytab specified with the
-t option, then the default keytab will be used.

-tkeytab

Use keytab to decrypt the KDC response. This can only be used
with the -k option.

-n

Requests anonymous processing. Two types of anonymous principals
are supported. For fully anonymous Kerberos, configure PKINIT on
the KDC and configure pkinit_anchors in the client’s
krb5.conf. Then use the -n option with a principal
of the form @REALM (an empty principal name followed by the
at-sign and a realm name). If permitted by the KDC, an anonymous
ticket will be returned. A second form of anonymous tickets is
supported; these realm-exposed tickets hide the identity of the
client but not the client’s realm. For this mode, use kinit-n with a normal principal name. If supported by the KDC, the
principal (but not realm) will be replaced by the anonymous
principal. As of release 1.8, the MIT Kerberos KDC only supports
fully anonymous operation.

-ccredentials_cache

Use credentials_cache as the credentials cache. The
cache should contain a service ticket for the kadmin/ADMINHOST
(where ADMINHOST is the fully-qualified hostname of the admin
server) or kadmin/admin service; it can be acquired with the
kinit program. If this option is not specified, kadmin
requests a new service ticket from the KDC, and stores it in its
own temporary ccache.

-wpassword

Use password instead of prompting for one. Use this option with
care, as it may expose the password to other users on the system
via the process list.

-qquery

Perform the specified query and then exit. This can be useful for
writing scripts.

-ddbname

Specifies the name of the KDC database. This option does not
apply to the LDAP database module.

-sadmin_server[:port]

Specifies the admin server which kadmin should contact.

-m

If using kadmin.local, prompt for the database master password
instead of reading it from a stash file.

-e “enc:salt ...”

Sets the keysalt list to be used for any new keys created. See
Keysalt lists in kdc.conf for a list of possible
values.

-O

Force use of old AUTH_GSSAPI authentication flavor.

-N

Prevent fallback to AUTH_GSSAPI authentication flavor.

-xdb_args

Specifies the database specific arguments. See the next section
for supported options.

Database options can be used to override database-specific defaults.
Supported options for the DB2 module are:

-x dbname=*filename*

Specifies the base filename of the DB2 database.

-x lockiter

Make iteration operations hold the lock for the duration of
the entire operation, rather than temporarily releasing the
lock while handling each principal. This is the default
behavior, but this option exists to allow command line
override of a [dbmodules] setting. First introduced in
release 1.13.

-x unlockiter

Make iteration operations unlock the database for each
principal, instead of holding the lock for the duration of the
entire operation. First introduced in release 1.13.

Supported options for the LDAP module are:

-x host=ldapuri

Specifies the LDAP server to connect to by a LDAP URI.

-x binddn=bind_dn

Specifies the DN used to bind to the LDAP server.

-x bindpwd=password

Specifies the password or SASL secret used to bind to the LDAP
server. Using this option may expose the password to other
users on the system via the process list; to avoid this,
instead stash the password using the stashsrvpw command of
kdb5_ldap_util.

-x sasl_mech=mechanism

Specifies the SASL mechanism used to bind to the LDAP server.
The bind DN is ignored if a SASL mechanism is used. New in
release 1.13.

-x sasl_authcid=name

Specifies the authentication name used when binding to the
LDAP server with a SASL mechanism, if the mechanism requires
one. New in release 1.13.

-x sasl_authzid=name

Specifies the authorization name used when binding to the LDAP
server with a SASL mechanism. New in release 1.13.

-x sasl_realm=realm

Specifies the realm used when binding to the LDAP server with
a SASL mechanism, if the mechanism uses one. New in release
1.13.

-x debug=level

sets the OpenLDAP client library debug level. level is an
integer to be interpreted by the library. Debugging messages
are printed to standard error. New in release 1.12.

Creates the principal newprinc, prompting twice for a password. If
no password policy is specified with the -policy option, and the
policy named default is assigned to the principal if it exists.
However, creating a policy named default will not automatically
assign this policy to previously existing principals. This policy
assignment can be suppressed with the -clearpolicy option.

-allow_dup_skey disables user-to-user authentication for this
principal by prohibiting this principal from obtaining a session
key for another user. +allow_dup_skey clears this flag.

{-|+}requires_preauth

+requires_preauth requires this principal to preauthenticate
before being allowed to kinit. -requires_preauth clears this
flag. When +requires_preauth is set on a service principal,
the KDC will only issue service tickets for that service principal
if the client’s initial authentication was performed using
preauthentication.

{-|+}requires_hwauth

+requires_hwauth requires this principal to preauthenticate
using a hardware device before being allowed to kinit.
-requires_hwauth clears this flag. When +requires_hwauth is
set on a service principal, the KDC will only issue service tickets
for that service principal if the client’s initial authentication was
performed using a hardware device to preauthenticate.

{-|+}ok_as_delegate

+ok_as_delegate sets the okay as delegate flag on tickets
issued with this principal as the service. Clients may use this
flag as a hint that credentials should be delegated when
authenticating to the service. -ok_as_delegate clears this
flag.

{-|+}allow_svr

-allow_svr prohibits the issuance of service tickets for this
principal. +allow_svr clears this flag.

{-|+}allow_tgs_req

-allow_tgs_req specifies that a Ticket-Granting Service (TGS)
request for a service ticket for this principal is not permitted.
+allow_tgs_req clears this flag.

{-|+}allow_tix

-allow_tix forbids the issuance of any tickets for this
principal. +allow_tix clears this flag.

{-|+}needchange

+needchange forces a password change on the next initial
authentication to this principal. -needchange clears this
flag.

{-|+}password_changing_service

+password_changing_service marks this principal as a password
change service principal.

{-|+}ok_to_auth_as_delegate

+ok_to_auth_as_delegate allows this principal to acquire
forwardable tickets to itself from arbitrary users, for use with
constrained delegation.

{-|+}no_auth_data_required

+no_auth_data_required prevents PAC or AD-SIGNEDPATH data from
being added to service tickets for the principal.

-randkey

Sets the key of the principal to a random value.

-nokey

Causes the principal to be created with no key. New in release
1.12.

-pwpassword

Sets the password of the principal to the specified string and
does not prompt for a password. Note: using this option in a
shell script may expose the password to other users on the system
via the process list.

-eenc:salt,...

Uses the specified keysalt list for setting the keys of the
principal. See Keysalt lists in kdc.conf for a
list of possible values.

Modifies the specified principal, changing the fields as specified.
The options to add_principal also apply to this command, except
for the -randkey, -pw, and -e options. In addition, the
option -clearpolicy will clear the current policy of a principal.

This command requires the modify privilege.

Alias: modprinc

Options (in addition to the addprinc options):

-unlock

Unlocks a locked principal (one which has received too many failed
authentication attempts without enough time between them according
to its password policy) so that it can successfully authenticate.

Purges previously retained old keys (e.g., from change_password
-keepold) from principal. If -keepkvno is specified, then
only purges keys with kvnos lower than oldest_kvno_to_keep. If
-all is specified, then all keys are purged. The -all option
is new in release 1.12.

Retrieves all or some principal names. expression is a shell-style
glob expression that can contain the wild-card characters ?,
*, and []. All principal names matching the expression are
printed. If no expression is provided, all principal names are
printed. If the expression does not contain an @ character, an
@ character followed by the local realm is appended to the
expression.

Sets a string attribute on principal. String attributes are used to
supply per-principal configuration to the KDC and some KDC plugin
modules. The following string attribute names are recognized by the
KDC:

session_enctypes

Specifies the encryption types supported for session keys when the
principal is authenticated to as a server. See
Encryption types in kdc.conf for a list of the
accepted values.

otp

Enables One Time Passwords (OTP) preauthentication for a client
principal. The value is a JSON string representing an array
of objects, each having optional type and username fields.

Sets the minimum number of character classes required in a
password. The five character classes are lower case, upper case,
numbers, punctuation, and whitespace/unprintable characters.

-historynumber

Sets the number of past keys kept for a principal. This option is
not supported with the LDAP KDC database module.

-maxfailuremaxnumber

Sets the number of authentication failures before the principal is
locked. Authentication failures are only tracked for principals
which require preauthentication. The counter of failed attempts
resets to 0 after a successful attempt to authenticate. A
maxnumber value of 0 (the default) disables lockout.

-failurecountintervalfailuretime

(getdate time string) Sets the allowable time between
authentication failures. If an authentication failure happens
after failuretime has elapsed since the previous failure,
the number of authentication failures is reset to 1. A
failuretime value of 0 (the default) means forever.

-lockoutdurationlockouttime

(getdate time string) Sets the duration for which the principal
is locked from authenticating if too many authentication failures
occur without the specified failure count interval elapsing.
A duration of 0 (the default) means the principal remains locked
out until it is administratively unlocked with modprinc-unlock.

-allowedkeysalts

Specifies the key/salt tuples supported for long-term keys when
setting or changing a principal’s password/keys. See
Keysalt lists in kdc.conf for a list of the
accepted values, but note that key/salt tuples must be separated
with commas (‘,’) only. To clear the allowed key/salt policy use
a value of ‘-‘.

Retrieves all or some policy names. expression is a shell-style
glob expression that can contain the wild-card characters ?,
*, and []. All policy names matching the expression are
printed. If no expression is provided, all existing policy names are
printed.

Removes entries for the specified principal from a keytab. Requires
no permissions, since this does not require database access.

If the string “all” is specified, all entries for that principal are
removed; if the string “old” is specified, all entries for that
principal except those with the highest kvno are removed. Otherwise,
the value specified is parsed as an integer, and all entries whose
kvno match that integer are removed.